CVE-2026-44022 Details

A path traversal vulnerability has been identified in the LaTeX backend of Docling, affecting versions 2.73.0 prior to 2.91.0. The issue arises from inadequate path containment validation in the handling of LaTeX commands \\includegraphics, \\input, and \\include. This flaw allows attackers to create malicious LaTeX documents that exploit path traversal sequences to read arbitrary files from the file system accessible to the process. Additionally, sensitive files could be included in the converted document output, or potentially accessed configuration files, credentials, or other sensitive data.

Users can upgrade to Docling version 2.91.0, which addresses this vulnerability by implementing strict path validation to ensure all resolved paths remain within the base document directory. It is also recommended to avoid processing untrusted LaTeX documents or to do so in a sandboxed environment with restricted file system access.